FYI: 'Tennessee Information Protection Act' with NIST Security Standards Enacted

Tennessee Governor Bill Lee on May 11, 2023 signed into law House Bill 1181, making Tennessee the eighth state to enact a comprehensive consumer data privacy law, following California, Virginia, Colorado, Utah, Connecticut, Iowa, and Indiana. The law will take effect July 1, 2024.

 

PRIVACY PROGRAM

 

Under the new law, controllers and processors must create, maintain, and comply with a written privacy program that reasonably conforms to the National Institute of Standards and Technology (NIST) Privacy Framework entitled "A Tool for Improving Privacy through Enterprise Risk Management Version 1.0," and update the program as the Framework is revised.  

 

APPLICABILITY

 

The Act applies to persons that conduct business in Tennessee or produce products or services that are targeted to residents of Tennessee and that:

 

    During a calendar year, control, or process personal information of at least 100,000 consumers; or

    Control or process personal information of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal information.

 

EXEMPTIONS

 

Importantly, the Act exempts financial institutions and affiliates, or data subject to the Gramm-Leach-Bliley Act. Other exemptions include covered entities or business associates governed by the privacy, security, and breach notification rules issued pursuant to the Health Insurance Portability and Accountability Act, and the use of personal information to the extent the activity is regulated by and authorized under the Fair Credit Reporting Act.

 

CONSUMER RIGHTS

 

Consumers are provided the right to:

 

    Confirm whether a controller is processing the consumer's personal information and to access the personal information;

    Correct inaccuracies in the consumer's personal information;

    Delete personal information provided by or obtained about the consumer;

    Obtain a copy of the consumer's personal information that the consumer previously provided to the controller;

    Request that a controller that sold personal information about the consumer, or disclosed the information for a business purpose, disclose the:

        Categories of personal information the business sold;

        Categories of third parties to which the personal information was sold;

        Categories of personal information disclosed for a business purpose;

    Opt out of the sale of personal information.

 

SENSITIVE DATA

 

A controller may not process "sensitive data" without a consumer's consent.

 

"Sensitive data" includes:

 

    Personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status;

    The processing of genetic or biometric data for the purpose of uniquely identifying a natural person;

    The personal information collected from a known child; or

    Precise geolocation data.

 

CONTRACT REQUIREMENTS

 

A contract between a controller and a processor must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, the rights and obligations of both parties, and require that the processor:

 

    Ensure that each person processing personal information is subject to a duty of confidentiality with respect to the data;

    At the controller's direction, delete or return all personal information to the controller as requested at the end of the provision of services, unless retention of the personal information is required by law;

    Upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor's compliance with the obligations in this part;

    Allow, and cooperate with, reasonable assessments by the controller or the controller's designated assessor;

    Engage a subcontractor pursuant to a written contract in accordance that requires the subcontractor to meet the obligations of the processor with respect to the personal information.

 

DATA PROTECTION ASSESSMENTS

 

A controller must conduct and document a data protection assessment if the processing involves:

 

    targeted advertising;

    the sale of personal information;

    certain profiling;

    sensitive data;

    activities involving personal information that present a heightened risk of harm to consumers.

 

ENFORCEMENT

 

The Attorney General has the exclusive authority to enforce the Act. Prior to taking any action, the Attorney General must provide a controller or processor 60 days to cure the violation. In the absence of a cure, civil penalties up to $15,000 may be sought for each violation.

 

IMPRESSION

 

The Tennessee Act is similar to the other non-California data privacy laws recently enacted, though the requirement to have a privacy program based on the NIST Framework is unique.

 

The Framework was developed by a private-public collaboration that began in 2018, and "is a voluntary tool intended to help organizations identify and manage privacy risk so that they can build innovative products and services while protecting individuals' privacy."

 

 

 

Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6^th Floor
Chicago, Illinois 60602
Direct:  (312) 551-9320
Fax: (312) 284-4751

Mobile:  (312) 493-0874
Email: rwutscher@MauriceWutscher.com

 

Admitted to practice law in Illinois

 

 

 

Alabama   |   California   |   Florida   |   Illinois   |   Massachusetts   |   New Jersey   |   New York   |   Ohio   |   Pennsylvania   |   Tennessee   |   Texas   |   Washington, DC

 

 

NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.

Our updates and webinar presentations are available on the internet, in searchable format, at:

 

Financial Services Law Updates

 

and

 

The Consumer Financial Services Blog™

 

and

 

Webinars

  

 

 

 

 

FYI: Ill App Ct (1st Dist) Holds "Small Servicer" Exempt from RESPA Loss Mitigation Rules

The Appellate Court of Illinois, First District, recently held that a borrower failed to identify any meritorious defense sufficient to stop or undo a judicial foreclosure sale.

 

In so ruling, the Appellate Court rejected the borrower's arguments that the servicer failed to comply with the loss mitigation rules under the federal Real Estate Settlement Procedures Act (RESPA) that she claimed would have allowed her to cure her default, because the servicer qualified as a "small servicer" under 12 C.F.R. 1026.41(e)(4), and was therefore exempt from the loss mitigation rules.

 

A copy of the opinion is available at:  Link to Opinion

 

In 2007, a borrower executed a mortgage and note for $87,000 in favor of a lender ("mortgagee").  The borrower fell behind on her payment obligations.

 

In 2016, prior to the ending of the Home Affordable Modification Program (HAMP), the borrower applied for a HAMP modification with mortgagee. The mortgagee denied the mortgagor's HAMP modification request and filed a verified complaint for mortgage foreclosure in March of 2017. After a period of contested motion practice, the trial court entered an order of summary judgment and judgment of foreclosure and sale.

 

The foreclosure sale was scheduled on May 15, 2018. Prior to the sale, the borrower filed for Chapter 13 bankruptcy which was later converted into a Chapter 7 bankruptcy. In the bankruptcy proceeding, the borrower also brought UDAP claims against the mortgagee. The Bankruptcy Court dismissed the borrower's claims against the mortgagee and allowed the mortgagee to proceed with the foreclosure sale at the trial court.

 

In the trial court, the foreclosure sale was approved and occurred in January of 2020. The mortgagee repurchased the property and sought court approval of the sale in February 2020. In March of 2020, the mortgagor, pro se, raised new arguments and the trial court granted her leave to file a response to the motion for an order approving the sale by March 31, 2020 and the hearing was continued until May of 2020.

 

COVID-19's impact on the court system and moratorium on confirmation of judicial sales resulted in a delay of the approval of the sale. In January of 2021, the borrower filed a pro se answer, counterclaim, which was subsequently stricken. Furthermore, the suspension of the borrower's prior lawyer resulted in further delays while the parties litigated what misrepresentations were made by the borrower's prior lawyer. Ultimately, in February of 2022, the trial court entered an order confirming the judicial sale. The borrower timely appealed.

 

On appeal, the borrower raised three issues. First, she argued that the trial court erred in confirming the sale of the property because she never received a loss mitigation denial letter on her loan modification application as required by section 1024.41 of the Real Estate Settlement Procedures Act (RESPA) and Regulation X (12 C.F.R. § 1024.41). Second, the borrower argued that the trial court erred by confirming the sale of the property despite learning that she submitted a HAMP loan modification application which was not appropriately processed in accordance with RESPA or Regulation X by mortgagee, causing the borrower to no longer be eligible for the program. Third, mortgagor argued that the trial court erred by confirming the sale of the property by ignoring a preponderance of the evidence that showed that mortgagee neglected the borrower's numerous attempts to modify her loan and end her delinquency.

 

In Illinois, a judicial foreclosure sale is not complete until it has been approved by a trial court. Under section 15-1508(b), the trial court shall confirm a sale unless it finds that: (i) a notice required in accordance with subsection (c) of Section 15-1507 was not given, (ii) the terms of the sale were unconscionable, (iii) the sale was conducted fraudulently, or (iv) justice was otherwise not done. 735 ILCS 5/15-1508(b).  The burden of the party opposing confirmation of the sale must prove that that sufficient grounds exist to disprove the sale.

 

The Appellate Court noted that in order for the borrower to properly vacate the sale, she must demonstrate that "that justice was not otherwise done because either the lender, through fraud or misrepresentation, prevented the borrower from raising [her] meritorious defense to the complaint at an earlier time in the proceedings, or the borrower has equitable defenses that reveal she was otherwise prevented from protecting her property interests." Wells Fargo Bank, N.A. v. McCluskey, 2013 IL 115469 ¶ 26.

 

Here, the mortgagee argued that it was a small servicer under RESPA (12 CFR § 1026.41(e)(4)), and was therefore effectively exempt from the pre-foreclosure violations complained of by the mortgagor. The Appellate Court agreed that the mortgagee qualified as a "small servicer" and was exempt from the specific RESPA loss mitigation rules at issue.

 

As a result, the Appellate Court affirmed the trial court's judgment on the first two arguments raised by the borrower.

 

Lastly, the Appellate Court disagreed with the borrower's argument that a preponderance of the evidence showed that mortgagee neglected her numerous attempts to modify her loan and end her delinquency across the life of the loan and afterward and that section 15-1508(b)(iv) applied.  The Appellate Court disagreed because the borrower admitted to her prior inability to make her mortgage payments, failed to respond to the mortgagee's motion for summary judgment, and that the borrower defaulted on several forbearance options and was unable to make payments under her Chapter 13 bankruptcy plan.

 

Therefore, the Appellate Court held that the borrower failed to identify any meritorious defense sufficient to stop or undo the judicial sale, and confirmed the trial court's judgment.

 

 

Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6^th Floor
Chicago, Illinois 60602
Direct:  (312) 551-9320
Fax: (312) 284-4751

Mobile:  (312) 493-0874
Email: rwutscher@MauriceWutscher.com

 

Admitted to practice law in Illinois

 

 

 

Alabama   |   California   |   Florida   |   Illinois   |   Massachusetts   |   New Jersey   |   New York   |   Ohio   |   Pennsylvania   |   Tennessee   |   Texas   |   Washington, DC

 

 

NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.

Our updates and webinar presentations are available on the internet, in searchable format, at:

 

Financial Services Law Updates

 

and

 

The Consumer Financial Services Blog™

 

and

 

Webinars

  

 

 

 

 

FYI: Ill Sup Ct Holds E-Mail Service Not Proper for Judgment Enforcement Proceedings

In a lien priority dispute between two judgment creditors, the Illinois Supreme Court recently held that email delivery does not constitute proper service of process for judgment enforcement proceedings.

 

A copy of the opinion is available at:  Link to Opinion

 

An individual obtained a $4 million dollar judgement against a defendant. A lender separately obtained a $3.4 million dollar judgment against the same defendant for beach of a commercial lease agreement. Both the individual creditor and lender became judgment creditors seeking to enforce their respective judgments by initiating citation proceedings.

 

The parties both initiated a separate citation proceeding against a non-party music publishing company ("music company') that held over 1 million dollars in revenue from the defendant's song royalties. The individual sent her citation to discover assets to the music company via registered mail on August 17, 2020, with return receipt requested. On August 19, 2020, the lender e-mailed its citation to discover assets and also sent a copy through the regular mail.

 

On August 24, 2020, the individual creditor's citation was delivered to the music company. Also on August 24, 2020, counsel for the music company acknowledged receipt of the citation e-mailed by the lender. Counsel for the music company answered lender's citation on August 27, 2020, via a mailed response to lender. Counsel for the music company indicated they would appear on the citation and informed lender that it had received the individual's citation to discover assets on August 25, 2020. However, the individual's postal service receipt indicated delivery to the music company occurred on the day before (August 24, 2020).

 

At the trial court, the lender intervened in the individual's citation action and the individual intervened in the lender's action. The individual challenged lender's priority claim, provided the postal service return receipt showing service the music company occurred on August 24, 2020, and argued that because the music company was served with both citations on August 24, 2020, equity directed that the individual's lien should be prioritized over lender's lien.

 

The trial court found that the lender's lien was entitled to priority because neither lender nor individual had challenged whether service was proper and that the music company accepted service and responded to both citations without objecting to either service or the citations. The trial court denied the individual's motion to reconsider and the individual appealed.

 

The Appellate Court found that the individual had standing to challenge lender's e-mail service on the music company and concluded that email service was not a recognized method for service of a citation to discover assets. It further found that the individual's citation was entitled to priority, as it was complete four days after she mailed it based on Illinois Supreme Court Rule 12. Accordingly, the Appellate Court ordered the trial court to enter an order directing the music company to turn over the royalty funds to the individual and to continue to turn over the royalties until the individual's judgment was satisfied. Lender appealed to the Supreme Court of Illinois.

 

First, the Illinois Supreme Court examined whether or not the individual had standing to challenge service on the music company. The lender contended that the individual cannot object to service on the music company's behalf. In response, the individual argued that she has a real interest in the citation proceedings, which entitles her to challenge service on the music company.

 

In Illinois, standing requires "some injury in fact to a legally cognizable interest." Glisson v. City of Marion, 188 Ill. 2d 211, 221 (1999) The injury may be actual or threatened and "must be (1) distinct and palpable; (2) fairly traceable to the defendant's actions; and (3) substantially likely to be prevented or redressed by the grant of the requested relief." Id. In Illinois, the Supreme Court reviews issues of standing de novo. Piccioli v. Board of Trustees of the Teachers' Retirement System, 2019 IL 122905, ¶ 12.

 

The Illinois Supreme Court held that the individual had standing because she was asserting her own right to payment of the royalties, not any rights that belong to music company. In addition, the Court held, she had a real interest in the outcome of the citation proceeding involving the music company and her injury of losing her lien priority was distinct and palpable that can be traced to the music company's actions and the relief she requested from would prevent or redress her injury. Notably, the Illinois Supreme Court distinguished that the individual was not seeking to challenge whether the music company has the right to accept service of lender's citation by e-mail but instead challenged whether the lender's method of service to the music company in this circumstance can establish a lien priority over the individual's lien.

 

Next, the Illinois Supreme Court examined whether or not the individual forfeited her challenge to service by raising the issue for the first time in her motion to reconsider in the trial court. The Illinois Supreme Court agreed with the Appellate Court and held that forfeiture should be excused. In Illinois, a reviewing court may "overlook general forfeiture principles in a civil case and consider an issue not raised below if the issue is one of law, is fully briefed and argued by the parties, and the public interest favors considering the issue now." Forest Preserve District of Du Page County v. First National Bank of Franklin Park, 2011 IL 110759, ¶ 28. The Illinois Supreme Court held that excusing forfeiture was necessary to achieve a just result.

 

Lastly, the Illinois Supreme Court addressed the propriety of service by email. The lender argued that the Appellate Court erred when it found that its service on music company via e-mail was not authorized and did not entitle lender's lien to a priority position over individual's lien. Ultimately, this was a question of statutory and rule interpretation for the Supreme Court.

 

First, the Illinois Supreme Court examined section 2-1402 of the Code of Civil Procedure (Code) (735 ILCS 5/2-1402). Section 2-1402(a) of the Code provides that a judgment creditor may commence supplemental proceedings to enforce a judgment by serving a citation to discover assets upon a judgment debtor or any other person. Lender maintained that service by e-mail was authorized by Illinois Supreme Court Rule 11. However, Rule 11 does not apply to citation proceedings. 

 

The Illinois Supreme Court noted that, although e-mail service is a "method provided by law for service" as identified under Rule 105(b)(1), it does not apply to the commencement of a citation proceeding. Even if Rule 11 did apply to citation proceeding, the Court continued, the music company was not a party to the case and the scope of Rule 11 is limited to parties who have made an appearance. The Illinois Supreme Court further noted that Rule 105(b)(2) mandates service of a citation to discover assets via registered or certified mail with return receipt requested. Ill. S. Ct. R. 105(b)(2). Accordingly, the Court rejected the lender's argument that service of the citation occurred via email.

 

Lender also argued that the Appellate Court should be reversed because its decision and Illinois Supreme Court Rule 277 is contrary to the encouragement of agreements between attorneys. Lender argued that, because it is established that parties may agree to both the manner and method of service, citing National Equipment Rental, Ltd. v. Polyphasic Health Systems, Inc., 141 Ill. App. 3d 343, 347 (1986) that the service via email was proper. The Illinois Supreme Court rejected this argument because the ability of parties to agree to accept service and voluntarily appear at court does not allow them to disregard the applicable rules governing service.

 

In conclusion, the Illinois Supreme Court held that electronic service via e-mail is not authorized in citation proceedings, and that the Appellate Court properly rejected the lender's contention that it had lien priority based on its service by e-mail to the music company. Additionally, the electronic service by lender was not an authorized method of service in a citation proceeding. Because the individual's service of citation was received by the music company on August 24, 2020, as established by the postal service return receipt, the Court held that the individual's lien is entitled to priority.

 

 

 

Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6^th Floor
Chicago, Illinois 60602
Direct:  (312) 551-9320
Fax: (312) 284-4751

Mobile:  (312) 493-0874
Email: rwutscher@MauriceWutscher.com

 

Admitted to practice law in Illinois

 

 

 

Alabama   |   California   |   Florida   |   Illinois   |   Massachusetts   |   New Jersey   |   New York   |   Ohio   |   Pennsylvania   |   Tennessee   |   Texas   |   Washington, DC

 

 

NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.

Our updates and webinar presentations are available on the internet, in searchable format, at:

 

Financial Services Law Updates

 

and

 

The Consumer Financial Services Blog™

 

and

 

Webinars

  

 

 

 

 

FYI: Penn App Ct Holds Attempt to Collect Time-Barred Debt Did Not Violate FDCPA or PFCEUA

The Superior Court of Pennsylvania, an intermediate appellate court, recently affirmed a trial court's order sustaining preliminary objections to a complaint alleging violations of the Pennsylvania Fair Credit Extension Uniformity Act (PFCEUA), which incorporates by reference the federal Fair Debt Collection Practices (FDCPA).

 

In so ruling, the Superior Court held that the defendant collection agency was not obligated to advise the plaintiff consumer that her debt was time-barred in its dunning (collection) letter because the letter only sought the consumer's voluntary repayment and would not have deceived or misled the "least-sophisticated debtor."

 

A copy of the opinion is available at:  Link to Opinion

 

The consumer received a dunning letter from the defendant collection agency, which indicated that the agency had a "willingness to work" with the consumer on her account and was there to "assist and help" and "discuss other options."

 

The consumer filed suit, alleging that the letter violated Pennsylvania's PFCEUA, which incorporates the federal FDCPA, because it purportedly attempted to collect on a debt that was beyond the statute of limitations and was false, deceptive, or misleading.

 

In response to the consumer's complaint, the defendant debt collector filed preliminary objections arguing that its sending of the dunning letter to the consumer on an allegedly time-barred debt without disclosing that the debt was time-barred did not violate the FCEUA or FDCPA. The trial court sustained the debt collector's preliminary objections, holding that the consumer failed to plead sufficient facts to support a claim for a violation of the FCEUA or FDCPA. The consumer timely appealed.

 

On appeal, the consumer argued that the dunning letter was false, deceptive, or misleading because it offered "financial freedom even though such freedom had already been obtained by virtue of the statute of limitations" and because it invited her to settle but failed to inform her "that the debt is time-barred and the ramifications thereof."

 

Pursuant to Pennsylvania's FCEUA, "[i]t shall constitute an unfair or deceptive debt collection act or practice under this act if a debt collector violates any of the provisions of the [FDCPA.]"  73 P.S. 2270.4(a). The FDCPA prohibits debt collectors from using "any false, deceptive, or misleading representation or means in connection with the collection of any debt," including falsely representing "the character, amount, or legal status of any debt."  15 U.S.C. § 1692(e),(f).

 

Here, the Superior Court noted that the statute of limitations' expiration does not invalidate a debt, but just makes it legally unenforceable. Huertas v. Galaxy Asset Management, 641 F.3d 28, 32 (3d Cir. 2011). As long as the debt collector does not initiate or threaten legal action on a time-barred debt, it is permitted to seek voluntary repayment without advising that the statute of limitations has run. See id.

 

Because the debt collector did not threaten litigation on a time-barred, legally unenforceable debt but, instead, sought the consumer's voluntary repayment, the Superior Court concluded that the debt collector was not obligated to advise the consumer that the debt's statute of limitations had expired.

 

The consumer also urged the Superior Court to find that the dunning letter qualified as a settlement offer that suggested the resolution of litigation. However, the Court was not persuaded because the letter did not expressly use the term "settle" or, in the Court's view, carry the resulting inference of litigation. Additionally, the Court reasoned that even if the letter did expressly or implicitly contain an offer to settle, this, standing alone, would not render the letter false, deceptive or misleading because there is nothing improper about a settlement offer. See Tatis v. Allied Interstate, LLC, 882 F.3d 422, 430 (U.S. Court of Appeals 3rd Cir. 2018).

 

Instead, the Superior Court held that the proper question was whether, when read as a whole, the letter would "deceive or mislead the least-sophisticated debtor into believing that she has a legal obligation to pay the time-barred debt." Id. The Court could discern no such interpretation from the letter because it found that the phrases "willingness to work with you" and "discuss other options" could not reasonably be read to imply a threat of litigation.

 

 

 

Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6^th Floor
Chicago, Illinois 60602
Direct:  (312) 551-9320
Fax: (312) 284-4751

Mobile:  (312) 493-0874
Email: rwutscher@MauriceWutscher.com

 

Admitted to practice law in Illinois

 

 

 

Alabama   |   California   |   Florida   |   Illinois   |   Massachusetts   |   New Jersey   |   New York   |   Ohio   |   Pennsylvania   |   Tennessee   |   Texas   |   Washington, DC

 

 

NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.

Our updates and webinar presentations are available on the internet, in searchable format, at:

 

Financial Services Law Updates

 

and

 

The Consumer Financial Services Blog™

 

and

 

Webinars